backport 8310 to 0.1.1, because of possible (minor) security implications on netbsd.

svn:r8314

5 files changed, 10 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index 7b65034c0d..bc4a729a1c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,7 +12,9 @@ Changes in version 0.1.1.24 - 2006-09-xx [ongoing]
     - Fix configure.in to not produce broken configure files with
       more recent versions of autoconf. Thanks to Clint for his auto*
       voodoo.
-
+    - Fix NetBSD bug that could allow someone to force uninitialized RAM
+      to be sent to a server's DNS resolver.  This only effects NetBSD and
+      other platforms that that do not bounds-check tolower().
 
 Changes in version 0.1.1.23 - 2006-07-30
   o Major bugfixes:
diff --git a/src/common/compat.h b/src/common/compat.h
index 8e570cb269..7975dbb9ba 100644
--- a/src/common/compat.h
+++ b/src/common/compat.h
@@ -115,6 +115,9 @@ const void *tor_memmem(const void *haystack, size_t hlen, const void *needle,
 #define TOR_ISDIGIT(c)   isdigit((int)(unsigned char)(c))
 #define TOR_ISPRINT(c)   isprint((int)(unsigned char)(c))
 
+#define TOR_TOLOWER(c)   (char)tolower((int)(unsigned char)(c))
+#define TOR_TOUPPER(c)   (char)toupper((int)(unsigned char)(c))
+
 #ifdef MS_WINDOWS
 #define _SHORT_FILE_ (tor_fix_source_file(__FILE__))
 const char *tor_fix_source_file(const char *fname);
diff --git a/src/common/util.c b/src/common/util.c
index 19bf1736dc..f82cfc1263 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -316,7 +316,7 @@ void
 tor_strlower(char *s)
 {
   while (*s) {
-    *s = tolower(*s);
+    *s = TOR_TOLOWER(*s);
     ++s;
   }
 }
@@ -327,7 +327,7 @@ void
 tor_strupper(char *s)
 {
   while (*s) {
-    *s = toupper(*s);
+    *s = TOR_TOUPPER(*s);
     ++s;
   }
 }
diff --git a/src/or/config.c b/src/or/config.c
index aacb9ec7dd..d8ae9a47c2 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -1712,7 +1712,7 @@ get_default_nickname(void)
       *cp = '\0';
       break;
     }
-    *cp = tolower(*cp);
+    *cp = TOR_TOLOWER(*cp);
   }
 
   /* Strip invalid characters. */
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 2efd7b6f4a..10f5512ae3 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -1275,7 +1275,7 @@ router_parse_addr_policy_from_string(const char *s, int assume_action)
   len = strlen(s);
   cp = tmp = tor_malloc(len+2);
   for (idx = 0; idx < len; ++idx) {
-    tmp[idx] = tolower(s[idx]);
+    tmp[idx] = TOR_TOLOWER(s[idx]);
   }
   tmp[len]='\n';
   tmp[len+1]='\0';